STE WILLIAMS

Sophos Security Chet Chat – Episode 220 – Nov 4, 2015

Join Sophos experts John Shier and Paul Ducklin for the latest episode of our security podcast.

Listen to the week’s news in a way that’s fun, informative and educational – all in a tight, quarter-hour format.

LISTEN NOW

(Audio player above not working? Download MP3 or listen on Soundcloud.)

In this episode:

• [00’23”] Lest We Forget
• [00’00”] New CryptoWall strain extorts AND mocks
• [02’28”] Ransomware meets Linux
• [05’21”] When Penguins Attack
• [05’36”] Sophos Anti-Virus for Linux (free download)
• [06’20”] Comcast passwords for sale on Dark Web
• [08’00”] Tackling the Dark Web
• [11’31”] What smartphone should James Bond use?
• [13’18”] Learn more

Other podcasts you might like:

• Chet Chat 220 – What would YOU do with a $1,000,000 exploit?

• Chet Chat 219 – It’s not CLOUD computing, it’s CLOWN computing!

• Sophos Techknow – Malware on Linux – When Penguins Attack

• Sophos Techknow – Dealing with Ransomware

Get this and other Sophos podcasts:

Follow @NakedSecurity

Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/QlqrENuifCg/

RotM Security firm Cylance is using machine learning to fight what many firms regard as the already lost battle of keeping computers free of malware.

While mainstream thinking in the industry has moved towards acceptance that malware infections are inevitable and the focus has to be on detection and response, the US startup isn’t ready to throw in the towel. It claims its rule-based engine is far more effective than conventional antivirus software from the likes of Symantec and Intel Security (McAfee).

“Prevention is better than detection after the fact and the only way you can do that is with a machine,” said Grant Moerschel, sales engineering director at Cylance.

The firm is applying a stats-based approach to threat detection that it claims offers 99 per cent detection rates in comparison to the 40 per cent figures of conventional antivirus. Its technology has been trained using a sample of 300 million known good files and 300 million known bad files to understand the markers of malware that do not change even as crooks repackage their wares or make minor changes. The technology is not based on either sandboxing, signatures or conventional signatures.

“Our technology is extracting the DNA of malware before making a run-time judgment call, based on what’s statistically relevant,” Moerschel explained.

Some of the rules the technology follows is based on the experience of Cylance staff with a background in incident response.

Limited testing through VirusBulletin has been carried out but nothing conclusive to validate Cylance’s machine learning and deep learning approaches. However two clear advantages are apparent.

Firstly Cylance’s technology doesn’t need to hook into every process running on a desktop and therefore has a lower footprint. Secondly its agent can run effectively on air-gapped machines. This is important is industry sectors as diverse as oil and gas production, retail (point of sale terminals) and healthcare.

Cylance named Ignition as the first channel provider of CylancePROTECT endpoint protection products for the UK earlier this week. The announcement follows a $42m equity investment from investors, including DFJ, Dell Ventures, Capital One Ventures, and KKR, funds the three year-old startup plans to plough into sales and marketing. The technology is being marketed as a replacement for traditional antivirus packages.

Anti-malware firms such as Cylance and Romanian firm BitDefender are starting to talk up “artificial intelligence” as a form of defence. this terminology is perhaps a bit of a misnomer because the software is not actually writing new code for itself and simply following human-defined programming instructions. ®

Sponsored:
Data Loss Prevention Data Theft Prevention

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/11/12/cylance_machine_learning_anti_malware/

Users of Ammyy Admin may have been unwittingly downloading malware along with their remote desktop software.

A group called the Buhtrap gang is using the malware to spy on and control its victims’ computers as part of a series of targeted attacks, net security firm ESET warns.

The tactics in play show that fraudsters are increasingly picking up the ideas and techniques of the more advanced cyberspies.

The malware is being distributed via a strategic web compromise. Since late October, visitors to ammyy.com were offered a bundle containing not only the company’s legitimate Remote Desktop Software, Ammyy Admin, but also various malware packages.

Jean-Ian Boutin, a malware researcher at ESET, commented: “The fact that cybercriminals now use strategic web compromises is another sign of the gap closing between techniques used by cybercriminals and by actors behind so-called Advanced Persistent Threats.”

The cybercrooks served up a Lurk downloader before dishing out Corebot and switching to Buhtrap by the end of October. The Ranbyus and Netwire RAT malware strains were served one after the other at the start of November.

“Although these families are not linked, the droppers that could potentially have been downloaded from Ammyy’s website were the same in every case,” ESET explains. “Thus it is quite possible that the cybercriminals responsible for the website hack sold the access to different groups.”

Ammyy Admin is legitimate software package (used by top corporations and Russian banks, among others) even though it has a history of being abused by fraudsters. Several security software firms classify Ammyy as a potentially unwanted app. ®

Sponsored:
Data Loss Prevention Data Theft Prevention

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/11/12/fraudsters_ammyy_malware_downloads/

A chance finding by a German security researcher has revealed ATMs run by German Bank Sparkasse leaked potentially sensitive information during a software update.

Benjamin Kunz-Mejri, chief exec and founder of Germany based security firm Vulnerability Lab, came across the problem when he unsuccessfully attempted to use his card to withdraw funds. The cash machine become unavailable before Kunz-Mejri pressed a “special keyboard combination” that result in a display of a software update process on the ATM’s screen, as a blog post by Vulnerability Lab explains.

The screen went to temporarily not available mode. In this mode Benjamin used a special keyboard combination to trick the ATM into another mode. By usage of the special combination the console (cmd) became available ahead to the maintenance message on top of the screen after the card came out of the ATM. At that moment the researcher realises that there is a gap and used his iPhone to capture the bootChkN console output (Wincor Nixdorf) of the branch administrator.

The screen scrolled through a substantial amount of sensitive information including the bank’s main system branch usernames, serial numbers, firewall settings, network information, device IDs and more. “Using the data he would be easily able to takeover the ATM (Automated Teller Machine) of the Wincor Nixdorf series,” Vulnerability Lab claimed.

Kunz-Mejri used his iPhone to capture the bootChkN terminal output before reposting the images in a Vulnerability Lab advisory on the ATM insecurity find. During the ATM update process the keyboard was not disabled, something that played a central role in the resulting vulnerability.

The security researcher is well known for his work uncovering security bugs in the web-based applications of PayPal, Apple’s iTunes and others rather than vulnerabilities in hardware or embedded systems, much less ATMs.

The ATM machines encountered by Kunz-Mejri were manufactured by Wincor Nixdorf. El Reg approached both the bank and Wincor Nixdorf for comment but is yet to hear back from either. We’ll update this story as and when we learn more.

Bank Sparkasse has reportedly pushed out updates that fix the issue, first uncovered by Kunz-Mejri on ATMs in the German city of Kassel. Vulnerability Lab praised Bank Sparkasse for responding promptly and professionally to his vulnerability report. ®

Sponsored:
Data Loss Prevention Data Theft Prevention

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/11/12/german_atm_security_snafu/

How misguided notions of capability and lack of access to enterprise tools discourage diversity in Infosec.

About a year ago, I tweeted to help a friend looking for an entry-level security position. The first few responses were particularly telling. Everyone in our industry knows this dirty little secret: companies collectively pretend there are no junior Infosec opportunities. It seems like every posted opening requires fairly extensive experience with very specific tools or is front-loaded with “mid-level” or “senior” title signifiers, regardless of whether the actual job duties really require advanced skills. And even after getting the relevant education and/or certification, there’s a roadway laid out to newbies in our profession that isn’t very welcoming. That needs to change.

The point of entry to a career in security is blocked by many obstacles. Even if you find a company that recruits for junior positions, the first hurdle is the perception of capability. Tech companies encourage the view that they hire only the best and brightest — and only from the most prestigious institutions; bootcamp vets need not apply. This involves recruiting the most brilliant minds, paying top dollar, and then giving them only unstimulating administrative chores and busywork.

While this is okay for a time, eventually it leads to another enthusiastic job search and another lost seat. Instead, in addition to having geniuses on staff dreaming up the next multi-platform network protocol analyzer, most companies need someone to actually monitor the existing network, manage updates, analyze traffic, etc. Construction requires carpenters in addition to master builders. And creating a pipeline of learners is the best ramp up to creating the next generation of master builders.

So, if you can get by the capability bias, you’ll probably run directly into the next barricade: tool knowledge. More and more positions require direct experience with specific tools/compliance/standards.  A lot of the tools are expensive…so there’s no way to gain any experience with them until you are behind the paywall! Unless you are wealthy enough to afford your own Cisco Firewall Device or run a cluster (even with today’s free technologies), chances are you aren’t ever going to touch enterprise-grade tools anywhere but at work — work you can’t get without experience. It’s a Catch-22.

Networking — the human kind

Even knowing about the existence of these tools requires a community that can share that knowledge, as well as advice on obstacles into the job market. Everybody says that networking is the way over, under, and around these barriers. Join communities. Build relationships. Get referred. And it does work.

I was lucky enough to attend university in an area with an active tech community and, by nature, I’m the type of person who is willing to reach out. As a student, I had both the time and inclination to actively participate in campus-based groups like SecDaemons, attend meet-ups, and go to local conferences. I played the networking game without really even knowing it, building personal relationships around my area of study, which eventually led to important internships, which eventually led to employment in my chosen field.

But what if you’re an introvert? What if you don’t live in Silicon Valley or Chicago or Boston? What if you live in Smalltown, USA? How are you supposed to build relationships at those far-away meet-ups? Fly to security conferences? What if you have to pay rent? Support children? What if those networking opportunities aren’t so opportune? Too bad.

In point of fact, if you are interested in an Infosec career, but do not fit into a very narrow mold, there really is no visible point of entry for you. And this is both sad and wrong. In our socially aware and hyperconnected world, there should be a well-marked path to professional employment that does not rely on the cyber-equivalent of a good ol’ boy’s club. I think we, as an industry, need to get over our preconceptions and become a bit more welcoming to the different types of people who want to do what we do. Companies could encourage more diversity, perhaps offering apprenticeships instead of just internships, or holding free tool workshops for students, or directing recruitment toward nontraditional and less-obvious talent pools.

And we working pros could help more as well. Take a cue from the Jedi and mentor at least one Padawan, actively offer your knowledge and time and support to those trying to join our ranks. Now, this is just one perspective that certainly doesn’t present all the answers. But it’s pretty obvious to me that the point of entry in security hiring should be expanding, not disappearing.

Jamesha has been a security and technological professional for over 10 years and is currently working at CloudPassage. A voice in the community, she has worked at companies epically large and small, shaving tons of yaks along the way. Email: [email protected] View Full Bio

Article source: http://www.darkreading.com/operations/careers-and-people/point-of-entry-the-missing-link-in-the-security-hiring-gap/a/d-id/1323071?_mc=RSS_DR_EDT

What’s This?

Something malicious this way comes. A fast reaction can reduce your risk.

You have just detected an attack and alerted the incident-response team, one of 38 investigations you will likely conduct this year. Half of these are probably generic malware attacks, but the rest are higher-risk targeted attacks or data breaches. Now you are working against the clock and against the potentially exponential rate of further infections, trying to get your systems back to a known state.

What happens if you cannot stop the attack soon enough? We have all seen the immediate and public effects of a security breach, but what happens afterwards? You have isolated the machines that you think are infected and begun the laborious process of cleaning them. Or you buy new machines and operate completely separate networks while you carefully scrub and transfer data from the old to the new. Or maybe you find yourself so deep in a hole so quickly that you cannot dig your way out, so you just work around the infected machines.

These and other security scenarios are playing out at organizations around the world. Attackers are shifting to focused, designer attacks targeting specific companies and individuals. They have been testing the behaviors of preventative technologies and are learning how to get through security defenses and minimize detection. A fast and active incidence-response capability is now an important part of your overall security plan.

Our research underlines the importance of responding effectively within the first hour. You are probably already struggling with the volume of security data. There is so much data flowing in from your existing tools that it takes a long time to analyze it, delaying your response. Or you have made compromises on the data being collected, and you are missing important indicators of attack.

Risk Reduction

Speeding up incident detection and gaining an understanding of the potential impact and scope are the most important tasks in reducing risk. What you need is the ability to perform live investigations. Using historical data as the foundation, automated endpoint collectors can learn the system’s state and context, watching for any changes to network flow, registries, or processes that may indicate an attack. This also includes deleted files or dormant components, tricks that are commonly used to evade detection.

Quickly alerted to an attack and its potential scope, the next important tasks are taking action to minimize the impact, identifying which assets remain vulnerable, and updating security controls. When the endpoint collectors detect an attack event, they send alerts to security central. But you can also configure them to trigger other actions, depending on the nature of the alert. Do you want additional data collection, temporary changes to user privileges, or some other custom action that will assist the response team?

You can also trigger an investigation across all systems in the organization, greatly expanding the scale of your response. You no longer need to make assumptions about the attack’s progress, which can result in an artificially limited view of the affected systems. If you cannot scale the response fast and far enough, you could allow the criminals to work freely in one area while you try to contain just a portion of the infection.

Time and scale are the prime limiters of incidence response. Greater automation of data collectors, security triggers, and predefined reactions helps you detect sooner, respond faster, and hunt farther than you could before.

Torry Campbell is the Chief Technology Officer for Endpoint and Management technologies for Intel Security, formerly McAfee. From a decade at McAfee, he couples his security operations background with product management, development, and customer implementation experience to … View Full Bio

Article source: http://www.darkreading.com/partner-perspectives/intel/incidence-response-imperative-take-immediate-action/a/d-id/1323120?_mc=RSS_DR_EDT

PacSec Modern Samsung devices including the S6, S6 Edge and Note 4 can have phone calls intercepted using malicious base stations, according to initial research findings from two researchers.

Daniel Komaromy of San Francisco and Nico Golde of Berlin demonstrated the attacks on Samsung’s ‘Shannon’ line of baseband chips today at the Mobile Pwn2Own competition at PacSec, Toyko.

Full exploitation details of their research has not been publicly detailed, but it has been disclosed to Samsung.

Their cheap man-in-the-middle attack requires an OpenBTS base station to be established and located near target handsets.

Handsets will automatically connect to the bogus station.

The malicious base station then pushes firmware to the phone’s baseband processor (the chip that handles voice calls, and which isn’t directly accessible to end users).

The firmware patch pushes phone calls through the bogus base station, which redirects them to a proxy that records them and passes them on to the intended recipient.

Komaromy says the full impact of the attack along with any mitigating factors will be known once seasoned researchers examine their work.

“Our example of modifying the baseband to hijack calls is just an example,” Komaromy told Vulture South.

“The idea with hijacking would be that you can redirect calls to a proxy (like a SIP proxy) and that way you can man-in-the-middle the call.

“So that means the caller sees her original call connected – but it can be recorded in the proxy [which is how] it’s like a wiretap implant.”

Nico Golde (l) and Daniel Komaromy at Pwn2Own today. 📷 Drago Ruiu

The attack was tested on a new Samsung Galaxy S6 Edge which PacSec organiser Dragos Ruiu took out of its box and updated before handing it over.

“I turned it on next to their radio and then dialled myself,” Ruiu says of the demonstration held deep below the Tokyo conference to avoid pwning delegate phones. “And instead of ringing on my phone it rang on theirs.”

The hacker duo now own the phone as a prize and will in March travel to Canada for CanSecWest on a ski trip along with their spouses. They will present further technical detail of the attack at that lauded conference.

The Register would speculate that since the Qualcomm silicon in question isn’t unique to Samsung kit, other researchers are probably setting to work on other phones as you read this.

It comes as Chinese researcher Guang Gong popped the latest version of Google Chrome at the contest.

As El Reg reported, the attack likely affects all Android phones and allows the devices to be completely compromised through a single exploit that requires no interaction beyond visiting a crafted web site.

Ruiu is offering ski trips and vendors may cough up bug bounties in exchange for the winning hacks. Last year hackers hosed popular phones for shares in $425,000 in cash rewards, but security sponsors Google, Apple, Microsoft and Hewlett Packard’s Zero Day Initiative pulled out. ®

Sponsored:
OpenStack for enterprise: The tipping point cometh

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/11/12/mobile_pwn2own1/

Ransomware targeting Linux servers has been thwarted by hard working security boffins, with help from the software itself, mere days after its existence was made public.

The Linux.Encoder.1 ransomware seeks Linux systems to encrypt and like others of its ilk demands owners pay BitCoins to have files decrypted.

But the first iteration of the malware has, like most betas, proven fallible.

Not only can it be decrypted using scripts without the need for ransoms to be paid, but it can re-encrypt itself, corrupting files and even encrypting the ransom note that directs victims how to pay the extortion.

Bitdefender security wonks report both failures, including the flaw in Linux.Encoder’s local encryption key generation that allowed it to be removed and files decrypted.

“We looked into the way the (AES) key and initialisation vector are generated by reverse-engineering the Linux.Encoder.1 sample in our lab,” crypto geek Radu Caragea says.

“The tool determines the initialisation vector and the encryption key simply by analysing the file, then performs the decryption, followed by permission fixing.

“If your machine has been compromised, consider this a close shave. Most crypto-ransomware operators pay great attention to the way keys are generated in order to ensure your data stays encrypted until you pay.”

The secure random keys and initialisation vectors generate information from the libc rand() function, and are seeded with the current system timestamp at the point of encryption.

“This information can be easily retrieved by looking at the file’s timestamp [and] is a huge design flaw that allows retrieval of the AES key without having to decrypt it with the” attacker’s key, he says.

Caragea says BitDefender’s tool (available for free on its site) may not work for those Linux admins who have been infected with multiple instances of the Linux ransomware.

This is because files are encrypted using different keys which generates a race condition that truncates some file contents to zero.

The obliteration of Linux.Encoder.1 comes days after BitDefender released a preventative tool that would prevent the reigning ransomware kings Cryptowall and CTB Locker from executing on victim systems. It does so by preventing executables running from the Windows AppData and Startup folders

Those ransomware variants including the fourth iteration of Cryptowall also released this week are well built and do not contain publicly-known encryption implementation flaws that could allow files to be decrypted without payment. ®

Sponsored:
OpenStack for enterprise: The tipping point cometh

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/11/12/cures_for_ransomware_linux_cryptowall/

PacSec Modern Samsung devices including the S6, S6 Edge and Note 4 can have phone calls intercepted using malicious base stations, according to initial research findings from two researchers.

Daniel Komaromy of San Francisco and Nico Golde of Berlin demonstrated the attacks on Samsung’s ‘Shannon’ line of baseband chips today at the Mobile Pwn2Own competition at PacSec, Toyko.

Full exploitation details of their research has not been publicly detailed, but it has been disclosed to Samsung.

Their cheap man-in-the-middle attack requires an OpenBTS base station to be established and located near target handsets.

Handsets will automatically connect to the bogus station.

The malicious base station then pushes firmware to the phone’s baseband processor (the chip that handles voice calls, and which isn’t directly accessible to end users).

The firmware patch pushes phone calls through the bogus base station, which redirects them to a proxy that records them and passes them on to the intended recipient.

Komaromy says the full impact of the attack along with any mitigating factors will be known once seasoned researchers examine their work.

“Our example of modifying the baseband to hijack calls is just an example,” Komaromy told Vulture South.

“The idea with hijacking would be that you can redirect calls to a proxy (like a SIP proxy) and that way you can man-in-the-middle the call.

“So that means the caller sees her original call connected – but it can be recorded in the proxy [which is how] it’s like a wiretap implant.”

Nico Golde (l) and Daniel Komaromy at Pwn2Own today. 📷 Drago Ruiu

The attack was tested on a new Samsung Galaxy S6 Edge which PacSec organiser Dragos Ruiu took out of its box and updated before handing it over.

“I turned it on next to their radio and then dialled myself,” Ruiu says of the demonstration held deep below the Tokyo conference to avoid pwning delegate phones. “And instead of ringing on my phone it rang on theirs.”

The hacker duo now own the phone as a prize and will in March travel to Canada for CanSecWest on a ski trip along with their spouses. They will present further technical detail of the attack at that lauded conference.

The Register would speculate that since the Qualcomm silicon in question isn’t unique to Samsung kit, other researchers are probably setting to work on other phones as you read this.

It comes as Chinese researcher Guang Gong popped the latest version of Google Chrome at the contest.

As El Reg reported, the attack likely affects all Android phones and allows the devices to be completely compromised through a single exploit that requires no interaction beyond visiting a crafted web site.

Ruiu is offering ski trips and vendors may cough up bug bounties in exchange for the winning hacks. Last year hackers hosed popular phones for shares in $425,000 in cash rewards, but security sponsors Google, Apple, Microsoft and Hewlett Packard’s Zero Day Initiative pulled out. ®

Sponsored:
OpenStack for enterprise: The tipping point cometh

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/11/12/mobile_pwn2own1/

UK Home Secretary Theresa May will have to revamp the Investigatory Powers Bill to ban astrophysics: the cosmic background radiation bathes Earth in enough random numbers to encrypt everything forever.

Using the cosmic background radiation – the “echo of the Big Bang*” – as a random number generation isn’t a new idea, but a couple of scientists have run the slide-rule over measurements of the CMB power spectrum and reckon it offers a random number space big enough to beat any current computer.

Not in terms of protecting messages against any current decryption possibility: the CMB’s power spectrum offers a key space “too large for the encryption/decryption capacities of present computer systems”.

A straightforward terrestrial radio telescope, this Arxiv paper states, should be good enough to make “astrophysical entropy sources accessible on comparatively modest budgets”.

The Baylor University (in Waco, Texas) researchers, Jeffrey Lee and Gerald Cleaver, also note that even if Eve (attacker) watched the same bit of sky at the same time as Alice, she wouldn’t get the same random number, “due to random variations in photon energy at any sky frequency, spurious signals within the detectors, interference from other sources of stellar radio noise, etc.

“Therefore, the digitised CMB power spectrum obtained by Alice is unique and cannot be acquired through “identical” power spectrum observations of the CMB by Eve”.

Apart from the maths by which Lee and Cleaver demonstrate the CMB power spectrum’s randomness, another interesting wrinkle in the paper is that they suggest it could meet the requirements of America’s Federal Information Processing Standard 140-2.

Except for one thing: back when FIPS was created, the standard didn’t consider astrophysical sources for randomness, so it stipulates that “the RGB or portion of the RGB cryptographic module that generates the key must ‘reside’ within the FIPS 140 key-generating module.” ®

*Bootnote: Lest pedants or real astrophysicists lambast me on this point, yes: the CMB is actually, as Lee and Cleaver note, the “remnant of the Recombination Epoch in Big Bang cosmology”, rather than a direct “echo of the Big Bang”. ®

Sponsored:
OpenStack for enterprise: The tipping point cometh

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2015/11/12/big_bang_left_us_with_a_perfect_random_number_generator/